This page needs a newer browser to run its tools. You can still read everything here.

Web Security (OWASP Top 10:2025) Module 1

Foundations: the web, standards and threat thinking interview questions

Interview questions on “Foundations: the web, standards and threat thinking”: warm-ups, then what each harder question tests and how a good answer starts.

15 questions: 5 warm-ups and 10 with model answers · Levels: Fresher to staff

Warm-up questions

Short questions with short answers, each answered in full.

Fresher to mid

What do you need before you security-test a web application that someone else runs?

Answered in the lesson Start here: learn web security safely and legally
Fresher to mid

What is the difference between same-origin and same-site?

Answered in the lesson HTTP, origins and the browser security model
Fresher to mid

What is the difference between a CWE and a CVE?

Answered in the lesson Reading the OWASP Top 10:2025, CWE and ASVS
Fresher to mid

What does least privilege mean in a web application?

Answered in the lesson Security principles every builder applies
Fresher to mid

What do the six letters of STRIDE stand for, and what does each one threaten?

Answered in the lesson Threat modelling a feature in 30 minutes

Questions with model answers

What each question tests, the first step of a good answer and the follow-ups to expect.

Mid to senior

Your product manager wants you to run a vulnerability scanner against a partner company's staging API before the two systems are connected. What do you need in place before the first request, and what goes in writing?
What it tests

Knowing that only the system's owner can authorise a test, turning "run a scanner" into a written scope, and coordinating so the test cannot surprise or harm the partner.

First step

Settle whose system it is: the partner's, so neither you nor your product manager can authorise the scan. Then turn "run a scanner" into a scope the partner can sign: which hosts and endpoints, which tool and request rate, which days and hours, whose test accounts, what data may be touched, and whom each side calls if something breaks.
Follow-ups
- The partner agrees on a call but never sends anything in writing.
- The scan shows that staging shares a database with production.
- Halfway through, the scanner gets answers from a host you did not list.
From the lesson Start here: learn web security safely and legally
Model answer, Pro. Model answers open with any pass; prices are in the notice on this page.
Opening the model answers with your pass…
Model answers open with any MySmartCoPilot pass.
Pro pass · 1 week₹79$2.99
30 days₹179$5.99
1 year₹1,699$45
One payment; a pass never renews. The price shown is the total you pay: no fees or charges are added at checkout.
Passes can’t be bought right now, so the model answers can’t be opened at the moment. If you have a pass, enter your licence key.
Choose a pass I have a licence key
It also opens every other in-depth part in Learn and every Pro tool. Sales are final, except where the law gives you a right to withdraw, for example in the EU and the UK (refund policy).
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Fresher to mid

Every security test in your suite passes, yet a customer reports that changing the number in an invoice address showed them another customer's invoice. How can both be true, and how do you change the tests so that it cannot happen again?
What it tests

Seeing that tests cover only the cases they try, writing refusal tests from the access rule, and making one shared check that every route has to use.

First step

Look at what the existing tests actually try. Most suites check that the owner can read their own invoice and that a signed-out visitor is refused. Neither asks for someone else's invoice while signed in, which is the case the customer found, so the suite and the bug can both be real.
Follow-ups
- How do you make sure that a new route cannot skip the check?
- Invoice numbers are sequential. Does making them random fix the bug?
- How would you check whether anyone else used the gap?
From the lesson Start here: learn web security safely and legally
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

A teammate's API skips the session check for requests whose Origin header is https://admin.shop.example, because "only our admin console can send that". What is wrong with this, and how would you redesign the check?
What it tests

Knowing that forbidden headers bind only browsers, telling "which page sent this" from "who is calling", and putting authorisation on a session the server issued and verifies.

First step

Ask who can produce that header. A browser writes Origin itself, so a page on another site cannot fake it there, but any HTTP client outside a browser writes whatever Origin it likes. The check answers "which page did an honest browser load", not "who is calling", so it cannot stand in for the session check.
Follow-ups
- Is checking Origin useless, then?
- The admin console is reachable only from the office network. Does that change the answer?
- How would you test that the redesign holds?
From the lesson HTTP, origins and the browser security model
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

Your app runs at app.example.com, and each customer can publish a status page at their-name.example.com from templates they edit. The session cookie is set with Domain=example.com. What can go wrong, and what do you change?
What it tests

Reading cookie scope, seeing customer-controlled subdomains as a separate trust zone, and fixing it with host-only __Host- cookies and a separate registrable domain for customer content.

First step

Work out where the session cookie goes. With Domain=example.com the browser sends it to every name under example.com, the customers' status pages included, and any of those hosts can set a cookie for example.com that the app then receives. The app and pages it does not control share one cookie scope.
Follow-ups
- Would SameSite=Strict on the session cookie solve it?
- Why move customer pages to a separate registrable domain, not just another subdomain?
- How do you roll out the new cookie without signing everyone out more than once?
From the lesson HTTP, origins and the browser security model
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

Your manager asks the team to make the product "OWASP Top 10 compliant" within a quarter. What do you tell them, and what plan do you propose instead?
What it tests

Knowing that the Top 10 is an awareness document rather than a standard, and turning it into a plan that can be verified, with an ASVS level, tests and an order of work.

First step

Explain that the Top 10 is an awareness document: its categories group hundreds of weaknesses and set no requirements to meet, so nothing can be shown to comply with it. Then offer what can be checked: an ASVS 5.0.0 level chosen for the product's risk, with each requirement tied to a test or a review step.
Follow-ups
- Which level would you choose for an online pharmacy, and why?
- How do you show progress each sprint?
- A customer's security questionnaire asks: are you OWASP Top 10 compliant? How do you answer?
From the lesson Reading the OWASP Top 10:2025, CWE and ASVS
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Fresher to mid

In a test environment you find that one API route returns another customer's order when you change the order number. Write the finding as you would file it: what goes in it, and how do you rate its severity?
What it tests

Writing a finding with precise names (CWE, category, ASVS requirement, WSTG test), a reproduction, the impact, a severity with its reasoning, a fix and a regression test.

First step

Name it precisely: a user-supplied key selects the record and nothing checks the owner, which is CWE-639 under A01:2025 Broken Access Control, breaking ASVS v5.0.0-8.2.2. Then state the impact, whose data, how much and how easily it is reached, before you choose a severity.
Follow-ups
- Rate its severity with a named method and show your reasoning.
- The route is used only by the mobile app. Does that lower the rating?
- Which test do you add so that it cannot come back?
From the lesson Reading the OWASP Top 10:2025, CWE and ASVS
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

During a 40-minute outage of your authorisation service, the API kept answering requests, and some users did things their roles do not allow. What went wrong, and how do you design the system so that an outage cannot do that again?
What it tests

Finding a fail-open path, designing checks that fail closed without turning every outage into a total outage, and proving the design with fault-injection tests and alerts.

First step

Find the code path that answered while the service was down: a catch block, a timeout default or a "skip the check if unavailable" flag that turned no answer into yes. Then decide, route by route, what the safe answer is when the check cannot run; for anything that changes or reveals data, it is a refusal.
Follow-ups
- Refusing everything during an outage takes the product down. How do you limit that?
- How do you test the outage before it happens?
- What would you alert on?
From the lesson Security principles every builder applies
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

An admin was moved to a normal role at noon but kept using admin features until she signed out in the evening. Why did that happen, and how do you fix it without a full database lookup on every request?
What it tests

Seeing a role copied into a session or token as a cached decision, and choosing between per-request checks, short lifetimes and revocation, with what each costs.

First step

Find where the role lives after sign-in: copied into the server-side session, or into a signed token such as a JWT. Either way it is a copy made at sign-in, and nothing replaced it when the record changed, so every request until she signed out was decided by the old copy.
Follow-ups
- The role is inside a signed token that lives for 12 hours. What changes?
- How do you make role changes count within one minute?
- Which test proves the fix?
From the lesson Security principles every builder applies
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

Your team is adding referral coupons: each user gets a code, and both the referrer and the new user get a discount on a first order. Run a 30-minute threat model aloud: what do you draw, which threats do you expect, and which three tests do you ask for first?
What it tests

Running the four questions on a business feature: a data-flow diagram, STRIDE at the boundaries, dishonest-user abuse cases, and threats turned into invariants with tests and owners.

First step

Scope it to the coupon flow and draw it: the user, the checkout API, the coupon store, the orders database and the payment provider, with the boundary between the internet and your server. Then walk it as a user who wants the biggest discount for the least money, and write down each rule the flow must keep.
Follow-ups
- One person creates fifty accounts to refer themselves. Which control would you choose, and what does it cost honest users?
- Two orders apply the same single-use coupon at the same moment. What goes wrong?
- Which threat would you accept, and how would you record it?
From the lesson Threat modelling a feature in 30 minutes
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Senior to staff

A threat from your model would take a quarter of engineering time to fix properly. How do you decide between mitigating it, transferring it, accepting it or removing the feature, and what do you write down?
What it tests

Choosing a response from likelihood, impact and cost, using interim controls, and recording an accepted risk with an owner, a reason, a review date and the person allowed to accept it.

First step

Rate it first: how likely it is, how bad it would be, and what the full fix costs against that harm. Then look for a cheaper interim control that lowers the likelihood or the impact now, so that the choice is not between a quarter of work and doing nothing.
Follow-ups
- Who is allowed to accept the risk?
- What brings an accepted risk back for review?
- The feature brings in 2 % of revenue. Does removing it become an option?
From the lesson Threat modelling a feature in 30 minutes
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes

The lessons of this module

Start here: learn web security safely and legally Free lesson, Pro answers: 20 minutes
HTTP, origins and the browser security model Free lesson, Pro answers: 20 minutes
Reading the OWASP Top 10:2025, CWE and ASVS Free lesson, Pro answers: 15 minutes
Security principles every builder applies Free lesson, Pro answers: 15 minutes
Threat modelling a feature in 30 minutes Free lesson, Pro answers: 20 minutes

All Web Security (OWASP Top 10:2025) interview questions · The Web Security (OWASP Top 10:2025) track

Warm-up questions

What do you need before you security-test a web application that someone else runs?

What is the difference between same-origin and same-site?

What is the difference between a CWE and a CVE?

What does least privilege mean in a web application?

What do the six letters of STRIDE stand for, and what does each one threaten?

Questions with model answers

Your product manager wants you to run a vulnerability scanner against a partner company's staging API before the two systems are connected. What do you need in place before the first request, and what goes in writing?

Every security test in your suite passes, yet a customer reports that changing the number in an invoice address showed them another customer's invoice. How can both be true, and how do you change the tests so that it cannot happen again?

A teammate's API skips the session check for requests whose Origin header is https://admin.shop.example, because "only our admin console can send that". What is wrong with this, and how would you redesign the check?

Your app runs at app.example.com, and each customer can publish a status page at their-name.example.com from templates they edit. The session cookie is set with Domain=example.com. What can go wrong, and what do you change?

Your manager asks the team to make the product "OWASP Top 10 compliant" within a quarter. What do you tell them, and what plan do you propose instead?

In a test environment you find that one API route returns another customer's order when you change the order number. Write the finding as you would file it: what goes in it, and how do you rate its severity?

During a 40-minute outage of your authorisation service, the API kept answering requests, and some users did things their roles do not allow. What went wrong, and how do you design the system so that an outage cannot do that again?

An admin was moved to a normal role at noon but kept using admin features until she signed out in the evening. Why did that happen, and how do you fix it without a full database lookup on every request?

Your team is adding referral coupons: each user gets a code, and both the referrer and the new user get a discount on a first order. Run a 30-minute threat model aloud: what do you draw, which threats do you expect, and which three tests do you ask for first?

A threat from your model would take a quarter of engineering time to fix properly. How do you decide between mitigating it, transferring it, accepting it or removing the feature, and what do you write down?